McAfee Takes Belize: Social Engineering Lesson

Is your business protected against anyone who might try to steal sensitive information by tricking your employees, whether for financial gain or just good old revenge?

Answering that question is the obvious takeaway from eccentric antivirus firm founder John McAfee's claim that he gave 75 inexpensive laptops to government officials and telecommunications employees in Belize, for free. Unbeknownst to the recipients, however, McAfee had installed spyware on the laptops, resealed the laptop boxes to make the gifts appear to be brand new, and hired four people to monitor every keystroke subsequently captured by the spyware, as well as to remotely activate and monitor the laptops' microphones and Webcams.

Beware eccentric information security professionals bearing free laptops. But security pros with a grudge shouldn't be your only worry: What about unscrupulous corporate competitors, foreign nation states or any criminal out to make a quick buck?

"These men and women were given simple training on how to access and load software on someone's computer while they slept or ate or made long phone calls etc.," said McAfee in a blog post. "It's dead simple [to do that] if you're sleeping with someone."

Based on that spyware sting, McAfee claimed to uncover a government-run program that was giving citizenship to an average of 11 men per month, all new arrivals to Belize, and all Lebanese Arabic speakers. According to McAfee, the men are being sent by the extremist group Hezbollah to infiltrate the United States, aided by the Mexican Zetas criminal syndicate.

Is McAfee's tale -- and accompanying allegations of Belizean government corruption -- truth or fiction? So far, definitively answering that question seems impossible, owing to all of the evidence having been disseminated solely by McAfee, via his blog. Add in McAfee's claims that the government of Belize attempted to frame him for the murder of his neighbor, and his subsequent flight from justice -- or at least police questioning -- that saw McAfee flee Belize by land and by boat, trailed by journalists and eventually arriving in Guatemala, from which he was deported to Miami.

All of that suggests we may be dealing with a somewhat unreliable narrator, which is reinforced by his apparent penchant for gonzo journalism, if not spy fiction: "I arranged with 23 women and 6 men to be my operatives," according to his blog post. "Eight of the women were so accomplished that they ended up living with me. It was amazingly more efficient and they were easily convinced to check up on each other. One was so accomplished (Marcia) that she became a double agent and nearly got me killed."

Without a doubt, McAfee -- as he freely admits -- also bears a grudge, beginning from when he said Belizean agents raided his property in April. "I had asked for a simple apology and had received none. I was pissed. They had shot my dog, destroyed my property and stolen hundreds of thousands of dollars worth of things that I valued. They have still not been returned," he said.

Real or not, McAfee's assertions are a reminder of the ease with which people can be tricked through social engineering attacks, which are cheap, hard to detect, and can be just as effective as a high-tech exploit.

Nor are such attacks new. McAfee's ruse, for example, is a slight reworking of the old "free USB drives in the parking lot" trick, in which researchers scatter free USB drives in a parking lot and see how people respond. In one study, 60% of people who picked up one of the USB drives then plugged it into their PC. But when the researchers scattered USB drives that had a Department of Homeland Security logo on them, they found that 90% of people who picked up one of the drives plugged it into their PC.

That finding makes it clear that the lure of the freebie so often trumps any innate security smarts we possess. Businesses must thus beware cheap tricks, which from a data breach standpoint can end up being just as costly as more expensive or esoteric exploits. Accordingly, train employees to not divulge sensitive information without first verifying the identity of the person requesting the information. Install security tools that scan removable storage devices -- smartphones too -- for signs of malware. Above all, get your in-house information security professionals to think like social engineers: If they wanted to take down your organization, where would they start? Then pay them well, and make sure they don't accept free laptops from strangers.

I suspect that here in the U.S people (especially government workers) would probably be a little more reticent to accept a free laptop given security concerns. But most people would probably completely let their guard down if offered a "brand new" iPad...

You have to admit it is a very interesting way to gain access to top accounts. Who doesnGÇÖt want a new computer, and who is going to question the that they are not secured after setting their systems up? Is McAfee doing all this because he is angry with the Belize government or does he have a valid beef here with the corruption that is occurring?

Published: 2015-03-03Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.

Published: 2015-03-03** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in customer-controlled software. Notes: none.

How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.